services_hardening_config_parser.rs (1777B)
1 #![forbid(unsafe_code)] 2 3 use std::error::Error; 4 5 use rhi::{ 6 RHI_CONFIG_SCHEMA, RHI_CONFIG_SCHEMA_VERSION, RhiConfigProfile, RhiConfigV1ErrorKind, 7 parse_rhi_config_v1, 8 }; 9 10 const EXAMPLE: &str = include_str!("../contracts/services_hardening/config.v1.example.toml"); 11 12 #[test] 13 fn root_api_admits_the_canonical_document_and_exposes_only_redacted_effective_output() { 14 let document = parse_rhi_config_v1(EXAMPLE.as_bytes(), RhiConfigProfile::Production) 15 .expect("canonical configuration"); 16 assert_eq!(document.schema(), RHI_CONFIG_SCHEMA); 17 assert_eq!(document.schema_version(), RHI_CONFIG_SCHEMA_VERSION); 18 assert_eq!(document.relay_count(), 2); 19 assert_eq!(document.evidence_source_count(), 1); 20 21 let effective = document.effective().canonical_json(); 22 assert!(effective.contains("\"source\":\"toml\"")); 23 assert!(effective.contains("[redacted-public-key]")); 24 for forbidden in [ 25 "/var/lib/radroots", 26 "relay.example.com", 27 "relay-primary", 28 "trade-primary", 29 "2222222222222222", 30 "service_wrapping_key", 31 ] { 32 assert!(!effective.contains(forbidden)); 33 assert!(!format!("{document:?}").contains(forbidden)); 34 } 35 } 36 37 #[test] 38 fn root_api_failure_is_stable_and_source_free() { 39 let secret = "never-render-this-value"; 40 let invalid = EXAMPLE.replacen( 41 "shutdown_grace_ms = 30000", 42 &format!("unknown = \"{secret}\""), 43 1, 44 ); 45 let failure = parse_rhi_config_v1(invalid.as_bytes(), RhiConfigProfile::Production) 46 .expect_err("unknown field must fail"); 47 assert_eq!(failure.kind(), RhiConfigV1ErrorKind::InvalidDocument); 48 assert!(Error::source(&failure).is_none()); 49 assert!(!format!("{failure} {failure:?}").contains(secret)); 50 }